What is CLIR

Critical for identification of the potential sources of evidence in every network forensics investigation is the definition of the system architecture. The mobile network architecture has two main definitions, one concerning the network deployments before the 3GPP consolidated the mobile standardization, and one for the 3GPP networks onwards. Forensic investigators need to know both of them; the real-world network deployments include elements from different generations, so the uncovering of mobile network evidence requires knowledge of how every generation operates in practice. This chapter provides a detailed overview of the pre-3GPP network architecture, defining the critical elements for recognizing, acquiring, analyzing, and interpreting potential mobile network evidence.